Query your Switch using SNMP and Linux

So you want to query a switch using snmp to see which MACs are being seen on which ports. In that case you will need the BRIDGE-MIB. On Centos-5 it is supplied, but as part of the 'libsmi' package.

# rpm -qa | egrep 'libsmi|net-snmp' | sort
libsmi-0.4.5-2.el5
net-snmp-5.3.2.2-14.el5_7.1
net-snmp-libs-5.3.2.2-14.el5_7.1
net-snmp-utils-5.3.2.2-14.el5_7.1

So you need to create file '/etc/snmp/snmp.conf' and configure as follows:

# cat /etc/snmp/snmp.conf
mibdirs +/usr/share/mibs/ietf

Then you should have success with the following command.
Remember to use the correct community string - by default its usually 'public'.
And the mib object name IS case sensitive.

# snmptable -v1 -c public -Cbw 80 192.168.24.1 -IR BRIDGE-MIB::dot1dTpFdbTable
SNMP table: BRIDGE-MIB::dot1dTpFdbTable

           Address Port  Status
   0:c:29:45:21:9e   24 learned
   0:c:29:79:6c:73   24 learned
  0:12:3f:c3:9d:7b   19 learned
  0:14:38:a2:70:7e   15 learned
  0:14:5e:68:74:ed   17 learned
  0:1b:78:22:bc:30   21 learned
  0:26:55:e7:5b:f4   27 learned
  0:50:56:a7:61:32   22 learned
  64:31:50:cd:c7:0    0    self
 9c:8e:99:19:99:a6   23 learned
 9c:8e:99:c4:46:56   13 learned
  c8:4c:75:90:f:e0   28 learned

Status 'self' or 'mgmt' is the MAC of the switch itself - used for the management connection.

If you have a modular switch, you may want to check the logical to physical port name mapping, as show next. If you just have a simple switch, the port names are usually boring!

# snmpwalk -v1 -c public 192.168.24.1 -IR IF-MIB::ifName | head -n 5
IF-MIB::ifName.1 = STRING: 1
IF-MIB::ifName.2 = STRING: 2
IF-MIB::ifName.3 = STRING: 3
IF-MIB::ifName.4 = STRING: 4
IF-MIB::ifName.5 = STRING: 5

Before you run the above commands, it may be useful to ping every host on your subnet, just so that the switch has seen everything. You can use 'nmap' for that:

# nmap -n -sP 192.168.24.0/24

Good luck with the above. I've often found these command very useful!